Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

Filter by
Sorted by
Tagged with
1
vote
1answer
47 views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...
-1
votes
1answer
23 views

Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
14
votes
2answers
1k views

At which point can a system be compromised when downloading archived data from an untrusted source?

If I download archived data from a possibly untrusted source at which point am I at possible risk of harming my system: Initially downloading and saving the archived data (still packed) Unpacking the ...
-2
votes
0answers
46 views

Build a C2C server to communicate with malware [on hold]

So, I have a piece of linux malware that communicates with a C2C server that is no longer active. I have reverse-engineered the malware and figured the commands that it expects. It uses IRC for its ...
0
votes
0answers
66 views

What Tools Do People Use For Hunting Malware? [on hold]

I would like to hear about some of the tools that people use for hunting malware on a machine. This is not really for analyzing malware but more for detection of malware to see if a machine is ...
7
votes
2answers
392 views

How do AV scanners in VirusTotal check if a file is malicious or not and how trustworthy is its report?

So i have seen many times that people provide the virus total report for a file to prove its not a virus but i just checked and when i submit a file its not even uploading it (i checked my bandwidth),...
0
votes
0answers
32 views

How to design a script to remove WindowsFormsApplication5.exe malware? [closed]

I have a malware file with me that's been infecting my dad's laptops for over a year now. This malware is known popularly as WindowsFormsApplication5.exe malware and I think he has bad security ...
0
votes
0answers
46 views

How to get cross-site scripting (XSS) JavaScript samples? [closed]

For research purposes, how to get a large number of JavaScript samples, which exploit the cross-site scripting (XSS) vulnerabilities?
-1
votes
0answers
120 views

5 VirusTotal engines detecting the apk as malicious file. Should I be worried? [closed]

I don't usually download apps from untrusted sources or which are not available on play store but for some reason I downloaded an apk file and just to make sure it is not malicious, after downloading ...
0
votes
0answers
55 views

Will my Windows driver stop being reported as malware if signed? [duplicate]

I have developed an IRP hooking based driver for one of my clients. Avast oes not complain about it but his AV suite reports it as malware. The lient will eventually sign this driver, but will it ...
1
vote
1answer
54 views

Is it correct to say that AVs use the same signature-based detection methods in emulation as they do on static binaries?

Many malwares can be packed or encrypted and AVs will emulate their execution to allow them to unpack or decrypt themselves. Once they do, are AVs simply using the same hashing or pattern-matching ...
1
vote
1answer
49 views

Are the malware signatures used by AVs primarily created by human analysts or by automated means?

I've only ever read about human analysts creating signatures, but it seems like automated signature derivation would be less time-consuming and I'm surprised that I'm not seeing more about automated ...
0
votes
1answer
115 views

Malicious IP addresses [closed]

I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities. Is there any public database of malicious IP ...
0
votes
3answers
143 views

Are there types of malware that are so time-intensive to detect that AV vendors simply choose to not detect them? [closed]

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect ...
0
votes
1answer
47 views

Can a malicious optical disc infect Ubuntu without user action?

Assuming that a malign user has unlimited resources at his/her disposal to infect a computer running Ubuntu, but he/she is only limited in transferring the malware through an optical disc (CD, DVD, BD ...
1
vote
2answers
170 views

Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how?

Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage I know that in windows there is a linked list of processes that many rootkits tend to remove ...
0
votes
0answers
70 views

Keylogger, Published by Microsoft

Is it possible for a malicious Keylogger to appear as "Published by Microsoft" in the task manager? (I do not mean if windows have a build-in keylogger)
2
votes
2answers
106 views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
4
votes
3answers
283 views

Is it dangerous to be within range of a compromised WiFi network, even if you don't connect to it?

If a network has been compromised (e.g. someone is listening on the traffic or there has been malware implemented on it), is it safe to leave a device (PC, cell phone, gaming device, etc.) in range of ...
0
votes
0answers
24 views

Is it safe to run a malware on VirtualBox? [duplicate]

I have recently downloaded VirtualBox and I wanna test my malware. I have followed the tutorials but I'm not very sure about it. The things that I have changed are: Shared Folders set to Read on a ...
1
vote
1answer
62 views

Does malware beacon in regular intervals or irregular intervals?

I am trying to build a malware beaconing to C2 detection mechanism. One point of discussion is whether - Malware communicates in frequent even spaced time intervals (Ex: Every 10 seconds to its C2 ...
2
votes
0answers
39 views

Burst and rebuild pdf to discard eventual embedded malware

This question deals with how to scan, while i am curious if my acrobat reader DC is compromised but in an isolated container and i pull out the pdf. Is it safe to disassemble the pdf by pdftk burst .. ...
2
votes
2answers
154 views

How can a malware retrive victim data without compromising the malware owner?

I was wondering how can malware, for example a keylogger, deliver its data without compromising its owner? Because as soon as you know you got a malicious program running on your computer you could ...
-1
votes
1answer
69 views

How to delete browser malware? [closed]

I've got some malware so now my browser is sending requests to strange sites: Also if I click on any html element in a browser It may redirect me to unwanted pages I've tried to fix this using ...
1
vote
1answer
119 views

Why might malware make a DNS request for an epoch time converter?

I am analyzing malware and I see that two executables when run in a sandbox made DNS requests for www.epochconverter.com Why would an attacker risk detection by making a network request to ...
0
votes
2answers
104 views

I am getting “Your connection is not private” error and it disappears when I use a VPN

I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared. From ...
0
votes
1answer
130 views

How do I investigate a suspicious link?

I made a RuneScape account about a week ago. I stupidly responded to a scam by clicking on a link provided to me in the game. I think I may have a keylogger, which would explain why my new account was ...
0
votes
0answers
56 views

Does psexec exist by default on all Windows 7 machines?

During a review of the registry editor, I found psexec and psloggedon installed upon my personal laptop. A few times, I have also observed my anti-virus restricting communication with a external ...
0
votes
1answer
66 views

Installed sketchy Chrome extension - Potential malware infection?

So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. ...
0
votes
2answers
115 views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
1
vote
2answers
109 views

Is VirusTotal useful for finding malware in a WordPress database SQL export?

Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
0
votes
1answer
86 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
0answers
46 views

Are there any known instances of Apple iOS exploits that can remotely install malware on a device unauthenticated?

Title. Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?: Allows remote, unauthenticated installation of malware on the device. ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
0
votes
1answer
115 views

Is it possible to provide malware from a router?

I received a disturbing mail containing the password for my desktop computer account. In this mail the hacker stated that he used a vulnerability in my router with CVE: CVE-2020-1672. After searching ...
0
votes
3answers
113 views

Is it safe to plug an SD card or USB flash drive in my sytem if I turn the write protection on using the switch?

I know that plugging in some random SD card or USB drive in a system can be a bad idea because you may get malware on your system. Now imagine you found a storage device either a memory card or ...
43
votes
4answers
9k views

Should one buy new hardware after a system compromise?

If there are places on a laptop malicious programs can leave elements, hooks, backdoors etc, in locations such as BIOS, device controllers, firmware etc - what confidence can one have in wiping the ...
3
votes
1answer
155 views

When to use which rootkit?

According to my understanding so far: a kernel-space rootkits runs in ring0 and use techniques such as syscalls a user-space rootkits runs in ring3 and uses techniques such as library injections ...
1
vote
0answers
17 views

Can the Windows Event Log be edited by a malicious program? [duplicate]

Is it possible that a malware can edit the Windows Event Log to hide System Event Log entries (specifically 6005 and 6006, which indicate startup and shutdown respectively)? If it is not possible, ...
0
votes
1answer
154 views

How to inject a malware in a video

Is it possible to trigger an antivirus program to alarm by playing a video? I don't want to run malware, I only want the AV to do something. Can I put EICAR in the metadata? The video file shoudn't ...
1
vote
1answer
60 views

Executing vs Extracting PE32/PE32+ executable

If you have a malicious upon execution ("running" it / double clicking on it) .exe , would extracting its contents with something like 7-Zip utility mitigate its effects? Or can it still do harm?
3
votes
2answers
145 views

How this tracking (and more) was done using an image in an email?

As reported in the NY Times, there was some type of electronic spying in a high-profile military trial. Its claimed that the prosecutors were spying on the defense: The court-martial ... has been ...
0
votes
1answer
75 views

Is there a software that would scan the ports automatically, then predict if there are any malicious activity going on, on my Win10 PC? [closed]

I've got this malware(or spyware as Kaspersky detected), from the USB storage device by purely a lack of focus. After scanning and defecting all the drives that are connected to my computer with ...
0
votes
0answers
16 views

WMI ActiveScriptEventConsumer Creation Datec

So recently I've been trying to solve a ctf. I was able to determine WMI persistence mechanism is used with the aid of ActiveScriptEventConsumer& EventFilter classes. I believe finding the ...
0
votes
0answers
39 views

Protect LUKS encrypted HDD against boot sector key stealing attack

I have HDD with GPT, 1 MiB BIOS boot partition and LUKS encrypted volume group with data. When I boot the computer, GRUB asks for passphrase. However, I want to run some untrusted application which ...
-1
votes
1answer
79 views

Can a rootkit hide its data in slack space of pages in memory instead of disk?

So I'm asking about Linux or Windows type of rootkit/malware is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data? if so, has this ever been ...
1
vote
2answers
111 views

Notepad++ updater had no tittle or info. Is this okay?

While updating Notepad++, the updater window showed no title or information. Is this okay from security point of view ?
-4
votes
1answer
63 views

After have all the Patches, NotPetya can still run? [closed]

NotPetya runs inmediatly after infection or can be there and being executed even do i have all the security patches?
1
vote
1answer
115 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
33
votes
4answers
9k views

What is more safe for browsing the web: PC or smartphone?

The scenario is: somebody without concern about security is navigating through the web. This person will access doubtful websites, like adult content or media sharing, for example. Between a pc with ...